curl -X POST https://api.liddie.io/api/v1/me/webhook/rotate-secret \
--cookie "<dashboard session>"
// Dashboard-session endpoint: send your dashboard JWT as a Bearer token
const res = await fetch('https://api.liddie.io/api/v1/me/webhook/rotate-secret', {
method: 'POST',
headers: { Authorization: `Bearer ${dashboardJwt}` },
})
const { webhookSecret } = await res.json()
// Store webhookSecret now — it is never shown again
{ "webhookUrl": "", "webhookSecret": "<64-hex secret>" }
Webhooks
Rotate webhook secret
Generate a new Liddie webhook signing secret. It is shown only in this response, and the old secret stops verifying HMAC signatures immediately.
POST
/
api
/
v1
/
me
/
webhook
/
rotate-secret
curl -X POST https://api.liddie.io/api/v1/me/webhook/rotate-secret \
--cookie "<dashboard session>"
// Dashboard-session endpoint: send your dashboard JWT as a Bearer token
const res = await fetch('https://api.liddie.io/api/v1/me/webhook/rotate-secret', {
method: 'POST',
headers: { Authorization: `Bearer ${dashboardJwt}` },
})
const { webhookSecret } = await res.json()
// Store webhookSecret now — it is never shown again
{ "webhookUrl": "", "webhookSecret": "<64-hex secret>" }
Generates a new 64-hex signing secret and returns it — this response is the only place you’ll ever see it. No read endpoint returns the secret, so store it before you do anything else.
This endpoint takes no parameters — the merchant is inferred from your session.
How to verify delivery signatures with this secret is documented in the Webhooks & IPN guide.
The previous secret stops verifying the moment this call returns. Update your endpoint’s verifier in the same deploy, or deliveries will fail signature checks.
Who can call this
Dashboard only — API keys can’t configure webhooks. Send your dashboard JWT (browser session) as a Bearer token, with team rolemerchant_admin or merchant_member plus the webhooks:manage permission. Rate limit: 3 requests per minute. See the Authentication guide.
curl -X POST https://api.liddie.io/api/v1/me/webhook/rotate-secret \
--cookie "<dashboard session>"
// Dashboard-session endpoint: send your dashboard JWT as a Bearer token
const res = await fetch('https://api.liddie.io/api/v1/me/webhook/rotate-secret', {
method: 'POST',
headers: { Authorization: `Bearer ${dashboardJwt}` },
})
const { webhookSecret } = await res.json()
// Store webhookSecret now — it is never shown again
{ "webhookUrl": "", "webhookSecret": "<64-hex secret>" }
Response
string
The currently configured delivery URL (empty string if none is set).
string
The new 64-hex signing secret. Shown only in this response — store it now. The previous secret stops verifying immediately.
See also
- Webhooks & IPN — how to verify delivery signatures with this secret.
- Get webhook config — check whether a secret currently exists (
hasSecret). - Replay a delivery — re-send an event to test the new secret end to end.